Cookie Policy — Wehoz

What this policy covers

This policy explains what cookies, local-storage values, and similar tracking technologies Wehoz uses on wehoz.com (the “Site”), what each one does, how long it stays on your device, and how you can change your preferences at any time. It should be read together with our Privacy Policy.

Your choices in one place

You can change your tracking preferences from the cookie banner shown on your first visit, or any time from the cookie preferences link in our footer. We honor the Global Privacy Control (Sec-GPC: 1) browser signal — if your browser sends GPC, we automatically default Marketing and Analytics to off and record the signal in our consent audit trail.

The four categories we use

1. Strictly necessary cookies

These cookies are required for the Site to function and cannot be refused. They power things like keeping you signed in, remembering items in your cart, and protecting the checkout from cross-site request forgery.

whz_cart— identifies your cart session. Set by Wehoz. First-party. Duration: 30 days. Purpose: links anonymous cart items to your account when you sign in.
sb-access-token / sb-refresh-token— Supabase Auth session cookies. Set by Wehoz via Supabase. First-party. Duration: 1 hour (access) / 7 days (refresh). Purpose: keep you signed in.
whz_csrf— cross-site request forgery protection token. Set by Wehoz. First-party. Duration: session. Purpose: prevents form-submission abuse.
whz_ref / whz_aff / whz_visitor— referral and affiliate attribution. Set by Wehoz when you arrive through a referral or affiliate link. First-party. Duration: 30 days. Purpose: credits the right partner for your purchase.

2. Functional cookies

These cookies remember the choices you make so the Site behaves the way you expect on your next visit. You can opt out of functional cookies; the Site will still work, but your preferences will reset between sessions.

whz_theme— dark or light mode preference. Set by Wehoz. First-party. Duration: 1 year.
whz_recently_viewed— local storage; not a cookie, but counts as a tracking technology under most laws. Stores up to 20 product IDs you recently viewed. Lives on your device until you clear browser data.

3. Analytics cookies (consent required)

These cookies help us understand how the Site is used so we can improve it. We do not load analytics scripts unless you have granted Analytics consent or you have not yet made a choice in the cookie banner.

ph_*— PostHog product-analytics identifier and session data. Third-party (posthog.com). Duration: 1 year. Purpose: aggregated funnel and feature analytics. We do not enable PostHog session replay.
_ga, _ga_*— Google Analytics 4 cookies. Third-party (google-analytics.com). Duration: 2 years. Purpose: aggregated traffic measurement. We use IP anonymization where supported.

4. Marketing cookies (consent required)

We do not currently use marketing cookies. If we add advertising partners in the future we will update this section and ask for your consent before any new cookie is set.

Changing your preferences

Use the cookie banner the first time you visit. After that, you can change your choices any time from the “Cookie preferences” link in the site footer. Browser controls also let you delete cookies and block them at the source — see your browser’s documentation for details.

Audit trail

We record each consent change in our cookie-consent audit log so we can demonstrate compliance with GDPR Article 7. The record includes the timestamp, the cookie-policy version in effect at the time, the source of the change (banner, preferences page, GPC signal), and the choices you made — not the contents of any cookie.

Updates

When the list of cookies above changes, we update this page and bump the policy version. Material changes are also announced on the Site.

Contact

Questions about cookies: privacy@wehoz.com.